pr-checkmate 1.23.4 → 1.23.6

package/README.md

@@ -9,7 +9,7 @@
 ![jscpd](https://img.shields.io/badge/jscpd-5-blue)
 [![API Docs](https://img.shields.io/badge/API_docs-TypeDoc-9600FF?logo=readthedocs&logoColor=white)](https://pr-checkmate-docs.pages.dev)
 
-> PR CheckMate is a universal PR quality checker: one `npm install`, 49 checks across
+> PR CheckMate is a universal PR quality checker: one `npm install`, 50 checks across
 > 11 languages, running in CI on every pull request. The bundled languages need no
 > per-language toolchain setup.
 
@@ -108,7 +108,7 @@ skipped, not failed.
 
 ## Checks
 
-49 checks, grouped by category and run in parallel within each phase:
+50 checks, grouped by category and run in parallel within each phase:
 
 - Universal git-diff (18) — language-agnostic and bundled: merge-conflict markers,
   secret scan, diff security (JS/TS/Python/Go/Kotlin), GitHub Actions and Dockerfile
@@ -118,7 +118,7 @@ skipped, not failed.
 - Dependencies (7) — unused/missing, circular, outdated, license compliance, npm audit,
   a cross-language vuln scan (osv-scanner, opt-in), and a direct-dependency vuln scan
   (grype, on by default).
-- Quality (4) — duplicate code, dead code, multi-language spellcheck, markdown lint.
+- Quality (5) — duplicate code, dead code, multi-language spellcheck, markdown lint, YAML lint.
 - PR hygiene (4) — size, title, body, and commit-message convention.
 - Per-language (16) — lint, format, and type-check for the languages listed above.
 

package/dist/cli.js

@@ -19,6 +19,7 @@ const COMMAND_TO_CHECK = {
     'pr-title': 'PR Title',
     outdated: 'Outdated Deps',
     markdown: 'Markdown',
+    'yaml-lint': 'YAML Lint',
     typecheck: 'TypeScript',
     'diff-smell': 'Diff Smells',
     'diff-security': 'Diff Security',

package/dist/config/constants.js

@@ -240,6 +240,7 @@ exports.KNOWN_CONFIG_KEYS = new Set([
     'spellcheck',
     'cspell',
     'markdownlint',
+    'yamlLint',
     'typecheck',
     // security
     'security',

package/dist/config/loader.js

@@ -59,7 +59,12 @@ function mergeWithDefaults(userConfig) {
                 ...(userConfig.spellcheck?.ignorePaths || []),
             ],
         },
-        security: userConfig.security || defaults.security,
+        security: {
+            ...defaults.security,
+            ...userConfig.security,
+            gitleaks: { ...defaults.security?.gitleaks, ...userConfig.security?.gitleaks },
+            'npm-audit': { ...defaults.security?.['npm-audit'], ...userConfig.security?.['npm-audit'] },
+        },
         typecheck: { ...defaults.typecheck, ...userConfig.typecheck },
         cpp: {
             ...defaults.cpp,

package/dist/core/checks/dependencies/npm-audit.js

@@ -38,10 +38,17 @@ exports.npmAuditCheck = {
     },
     async run(ctx) {
         const auditLevel = ctx.config.security?.['npm-audit']?.auditLevel ?? 'moderate';
+        const ignore = new Set((ctx.config.security?.['npm-audit']?.ignore ?? []).map(name => name.toLowerCase()));
         const ownName = getOwnPackageName();
         const { stdout } = await (0, execa_1.execa)('npm', ['audit', '--json'], { cwd: ctx.cwd, reject: false });
         const report = JSON.parse(stdout);
-        const directVulns = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
+        const relevant = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
+        const [ignored, directVulns] = relevant.reduce(([skip, block], v) => {
+            (ignore.has(v.name.toLowerCase()) ? skip : block).push(v);
+            return [skip, block];
+        }, [[], []]);
+        // Ignored advisories stay visible as warnings — an exception is not a silent drop.
+        ignored.forEach(v => utils_1.logger.warn(`[NPM Audit]: ⚠ ${v.name} — severity: ${v.severity} (ignored via config)`));
         if (directVulns.length === 0)
             return (0, types_1.pass)();
         directVulns.forEach(v => utils_1.logger.error(`[NPM Audit]: ❌ ${v.name} — severity: ${v.severity}`));

package/dist/core/checks/quality/yaml-lint.d.ts

@@ -0,0 +1,13 @@
+import { Check } from '../../types';
+/**
+ * Bundled YAML linter (the `yaml` package — no runner dependency, always
+ * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file
+ * and reports the parser's own errors and warnings: syntax errors, duplicate map
+ * keys, tabs used as indentation, and other structural problems. Multi-document
+ * files (`---`-separated) are each parsed. ON by default — runs unless
+ * `yamlLint.enabled` is explicitly `false`. Findings are a hard error by default
+ * (a YAML problem fails the run); downgrade to advisory with
+ * `yamlLint.severity: "warn"`. Clients can exclude paths with `yamlLint.ignore`
+ * (glob patterns) in pr-checkmate.json.
+ */
+export declare const yamlLintCheck: Check;

package/dist/core/checks/quality/yaml-lint.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.yamlLintCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const yaml_1 = require("yaml");
+const utils_1 = require("../../../utils");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/** First line of a `yaml` error/warning message, stripped of its source excerpt. */
+function shortMessage(message) {
+    return message.split('\n')[0].trim();
+}
+/**
+ * Bundled YAML linter (the `yaml` package — no runner dependency, always
+ * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file
+ * and reports the parser's own errors and warnings: syntax errors, duplicate map
+ * keys, tabs used as indentation, and other structural problems. Multi-document
+ * files (`---`-separated) are each parsed. ON by default — runs unless
+ * `yamlLint.enabled` is explicitly `false`. Findings are a hard error by default
+ * (a YAML problem fails the run); downgrade to advisory with
+ * `yamlLint.severity: "warn"`. Clients can exclude paths with `yamlLint.ignore`
+ * (glob patterns) in pr-checkmate.json.
+ */
+exports.yamlLintCheck = {
+    name: 'YAML Lint',
+    phase: 'blocking',
+    applies(ctx) {
+        return ctx.config.yamlLint?.enabled !== false;
+    },
+    async run(ctx) {
+        const allTargets = await (0, targets_1.resolveTargetFiles)(ctx, ['*.yml', '*.yaml']);
+        if (allTargets === null)
+            return (0, types_1.skip)('git unavailable');
+        if (allTargets.length === 0)
+            return (0, types_1.skip)('no YAML files');
+        const ignore = ctx.config.yamlLint?.ignore ?? [];
+        const targets = ignore.length > 0 ? allTargets.filter(f => !(0, utils_1.matchesAnyGlob)(f, ignore)) : allTargets;
+        if (targets.length === 0)
+            return (0, types_1.skip)('all YAML files ignored');
+        const issues = [];
+        for (const file of targets) {
+            let source;
+            try {
+                source = node_fs_1.default.readFileSync(node_path_1.default.join(ctx.cwd, file), 'utf-8');
+            }
+            catch (err) {
+                utils_1.logger.warn(`[YAML Lint]: ⚠️ Could not read ${file}: ${err}`);
+                continue;
+            }
+            // parseAllDocuments never throws — it collects problems on each document,
+            // so a single malformed file cannot abort the whole check.
+            const docs = (0, yaml_1.parseAllDocuments)(source, { prettyErrors: true });
+            for (const doc of docs) {
+                for (const problem of [...doc.errors, ...doc.warnings]) {
+                    const pos = problem.linePos?.[0];
+                    issues.push({
+                        file,
+                        line: pos?.line,
+                        col: pos?.col,
+                        message: shortMessage(problem.message),
+                    });
+                }
+            }
+        }
+        if (issues.length === 0)
+            return (0, types_1.pass)();
+        // YAML problems are a hard error by default; a repo may downgrade to `warn`
+        // via `yamlLint.severity`.
+        const sev = (0, findings_1.severityEmitter)(ctx.config.yamlLint?.severity, 'error');
+        issues.slice(0, 10).forEach(i => {
+            const where = i.line ? `:${i.line}${i.col ? `:${i.col}` : ''}` : '';
+            sev.log(`[YAML Lint]: ${sev.icon} ${i.file}${where} — ${i.message}`);
+        });
+        if (issues.length > 10)
+            sev.log(`[YAML Lint]:   ... and ${issues.length - 10} more`);
+        return sev.emit(`${issues.length} YAML issue(s) found`);
+    },
+};

package/dist/core/registry.js

@@ -45,6 +45,7 @@ const duplicate_check_1 = require("./checks/quality/duplicate-check");
 const license_header_1 = require("./checks/quality/license-header");
 const markdown_lint_1 = require("./checks/quality/markdown-lint");
 const spellcheck_1 = require("./checks/quality/spellcheck");
+const yaml_lint_1 = require("./checks/quality/yaml-lint");
 const diff_security_1 = require("./checks/security/diff-security");
 const dockerfile_security_1 = require("./checks/security/dockerfile-security");
 const migration_safety_1 = require("./checks/security/migration-safety");
@@ -93,6 +94,7 @@ exports.REGISTRY = [
     outdated_deps_1.outdatedDepsCheck,
     markdown_lint_1.markdownLintCheck,
     spellcheck_1.spellcheckCheck,
+    yaml_lint_1.yamlLintCheck,
     python_lint_1.pythonLintCheck,
     python_typecheck_1.pythonTypecheckCheck,
     dead_code_1.deadCodeCheck,

package/dist/index.d.ts

@@ -8,3 +8,5 @@ export { pass, warn, fail, skip, defineCheck } from './core';
 export type { Check, CheckContext, CheckOutcome, CheckReport, CheckResult, CheckStatus, Language, Phase, ReporterFn, ReporterKind, RunOptions, } from './core';
 export { getSourcePath, getSourcePaths, getIgnoredDirs, getPackageConfigPath, hasLocalConfig, } from './config';
 export type { PRCheckMateConfig } from './interfaces';
+export { Logger } from './utils/logger';
+export type { LogLevel } from './utils/logger';

package/dist/index.js

@@ -5,7 +5,7 @@
  * @module pr-checkmate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasLocalConfig = exports.getPackageConfigPath = exports.getIgnoredDirs = exports.getSourcePaths = exports.getSourcePath = exports.defineCheck = exports.skip = exports.fail = exports.warn = exports.pass = exports.REGISTRY = exports.buildContext = exports.runChecks = void 0;
+exports.Logger = exports.hasLocalConfig = exports.getPackageConfigPath = exports.getIgnoredDirs = exports.getSourcePaths = exports.getSourcePath = exports.defineCheck = exports.skip = exports.fail = exports.warn = exports.pass = exports.REGISTRY = exports.buildContext = exports.runChecks = void 0;
 // Primary programmatic API: run checks and receive a structured report.
 // Never throws for violations, never calls process.exit — the caller decides.
 var core_1 = require("./core");
@@ -26,3 +26,7 @@ Object.defineProperty(exports, "getSourcePaths", { enumerable: true, get: functi
 Object.defineProperty(exports, "getIgnoredDirs", { enumerable: true, get: function () { return config_1.getIgnoredDirs; } });
 Object.defineProperty(exports, "getPackageConfigPath", { enumerable: true, get: function () { return config_1.getPackageConfigPath; } });
 Object.defineProperty(exports, "hasLocalConfig", { enumerable: true, get: function () { return config_1.hasLocalConfig; } });
+// Standalone logging utility. Consumers instantiate their own Logger so their
+// log level and buffer stay independent from pr-checkmate's internal logger.
+var logger_1 = require("./utils/logger");
+Object.defineProperty(exports, "Logger", { enumerable: true, get: function () { return logger_1.Logger; } });

package/dist/init.js

@@ -68,6 +68,14 @@ const DEFAULT_CONFIG = {
         rules: {},
         ignores: [],
     },
+    // YAML lint (bundled `yaml` parser). Reports syntax errors, duplicate keys,
+    // and tab/indentation problems in .yml/.yaml files. Blocking by default
+    // (severity "error"); set severity "warn" to make it advisory, or enabled
+    // false to disable. `ignore` takes glob patterns to skip (e.g. "charts/**").
+    yamlLint: {
+        enabled: true,
+        ignore: [],
+    },
     // TypeScript type check
     typecheck: {
         enabled: true,

package/dist/interfaces/index.d.ts

@@ -48,12 +48,13 @@ export interface PRCheckMateConfig {
     };
     security?: {
         gitleaks?: {
-            enabled: boolean;
+            enabled?: boolean;
             version?: string;
         };
         'npm-audit'?: {
-            enabled: boolean;
-            auditLevel: string;
+            enabled?: boolean;
+            auditLevel?: string;
+            ignore?: string[];
         };
     };
     typecheck?: {
@@ -196,6 +197,11 @@ export interface PRCheckMateConfig {
     configValidation?: {
         enabled?: boolean;
     };
+    yamlLint?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+        ignore?: string[];
+    };
     vulnScan?: {
         enabled?: boolean;
     };

package/dist/utils/logger.d.ts

@@ -1,5 +1,5 @@
-type LogLevel = 'log' | 'info' | 'warn' | 'error' | 'debug';
-declare class Logger {
+export type LogLevel = 'log' | 'info' | 'warn' | 'error' | 'debug';
+export declare class Logger {
     private logs;
     private levelOrder;
     private currentLevel;
@@ -17,4 +17,3 @@ declare class Logger {
     clear(): void;
 }
 export declare const logger: Logger;
-export {};

package/dist/utils/logger.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.logger = void 0;
+exports.logger = exports.Logger = void 0;
 class Logger {
     constructor() {
         this.logs = [];
@@ -65,4 +65,5 @@ class Logger {
         this.logs = [];
     }
 }
+exports.Logger = Logger;
 exports.logger = new Logger();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.4",
+    "version": "1.23.6",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -95,11 +95,12 @@
         "inquirer": "^14.0.2",
         "jscpd": "^5.0.11",
         "license-checker": "^25.0.1",
-        "markdownlint-cli2": "^0.23.0",
+        "markdownlint-cli2": "^0.23.1",
         "prettier": ">=3.0.0",
         "ts-node": "^10.9.1",
         "ts-unused-exports": "^11.0.1",
-        "typescript": "^6.0.3"
+        "typescript": "^6.0.3",
+        "yaml": "^2.9.0"
     },
     "devDependencies": {
         "standard-version": "^9.5.0",

package/pr-checkmate.schema.json

@@ -100,6 +100,33 @@
         "ignore": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "security": {
+      "type": "object",
+      "properties": {
+        "gitleaks": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "version": { "type": "string" }
+          }
+        },
+        "npm-audit": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "auditLevel": {
+              "type": "string",
+              "enum": ["info", "low", "moderate", "high", "critical"]
+            },
+            "ignore": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Package names whose vulnerabilities never block, even when direct and at/above auditLevel. Still reported as warnings."
+            }
+          }
+        }
+      }
+    },
     "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
     "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
     "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },
@@ -121,6 +148,14 @@
     "caseCollision": { "$ref": "#/$defs/toggle" },
     "sensitiveFileGuard": { "$ref": "#/$defs/toggle" },
     "configValidation": { "$ref": "#/$defs/toggle" },
+    "yamlLint": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "ignore": { "type": "array", "items": { "type": "string" } }
+      }
+    },
     "typecheck": { "$ref": "#/$defs/toggle" },
     "prBody": {
       "type": "object",

package/src/config/pr-checkmate.schema.json

@@ -100,6 +100,33 @@
         "ignore": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "security": {
+      "type": "object",
+      "properties": {
+        "gitleaks": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "version": { "type": "string" }
+          }
+        },
+        "npm-audit": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "auditLevel": {
+              "type": "string",
+              "enum": ["info", "low", "moderate", "high", "critical"]
+            },
+            "ignore": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Package names whose vulnerabilities never block, even when direct and at/above auditLevel. Still reported as warnings."
+            }
+          }
+        }
+      }
+    },
     "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
     "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
     "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },
@@ -121,6 +148,14 @@
     "caseCollision": { "$ref": "#/$defs/toggle" },
     "sensitiveFileGuard": { "$ref": "#/$defs/toggle" },
     "configValidation": { "$ref": "#/$defs/toggle" },
+    "yamlLint": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "ignore": { "type": "array", "items": { "type": "string" } }
+      }
+    },
     "typecheck": { "$ref": "#/$defs/toggle" },
     "prBody": {
       "type": "object",